Critical: squid:4 security update
Summary
ALSA-2023:7213: Critical: squid:4 security update. Affects libecap across 2 version ranges.
< 1.0.1-2.module_el8.6.0+2741+01592ae8
< 1.0.1-2.module_el8.6.0+3048+383bc947
Fixed in 1.0.1-2.module_el8.6.0+2741+01592ae8 or 1.0.1-2.module_el8.6.0+3048+383bc947, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. It is widely used to improve web server performance by caching frequently accessed content. The squid package is an essential component for many web servers and proxy servers.
Vulnerability Detail
The squid:4 security update addresses two critical vulnerabilities:
-
Denial of Service in HTTP Digest Authentication (CVE-2023-46847): This vulnerability allows an attacker to cause a denial of service by sending specially crafted HTTP Digest Authentication requests. This can lead to a complete disruption of the proxy server's functionality.
-
Request/Response smuggling in HTTP/1.1 and ICAP (CVE-2023-46846): This vulnerability enables an attacker to manipulate the HTTP/1.1 and ICAP protocols to bypass security controls and perform various attacks, including cache poisoning, cross-site scripting, and session hijacking.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update libecap-
< 1.0.1-2.module_el8.6.0+2741+01592ae81.0.1-2.module_el8.6.0+2741+01592ae8 -
< 1.0.1-2.module_el8.6.0+3048+383bc9471.0.1-2.module_el8.6.0+3048+383bc947
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
The squid:4 security update addresses critical vulnerabilities that can lead to denial of service and various attacks. It is crucial to update the squid package to the latest version to ensure the security and stability of your web server or proxy server. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for libecap →
FAQ
Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. It improves web server performance by caching frequently accessed content.
CVE-2023-46847 allows an attacker to cause a denial of service by exploiting a vulnerability in the HTTP Digest Authentication implementation. This can lead to a complete disruption of the proxy server's functionality.
CVE-2023-46846 enables an attacker to manipulate the HTTP/1.1 and ICAP protocols to bypass security controls and perform various attacks, including cache poisoning, cross-site scripting, and session hijacking.
You can use Vulert's playground at Vulert Scanner to check if your squid installation is affected by these vulnerabilities. Simply upload your package-lock.json file and Vulert will analyze it in real-time.
No, there is no known workaround for these vulnerabilities. It is recommended to update the squid package to the latest version.
Related vulnerabilities
Recent vulnerabilities recorded for libecap.
